Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What tools should I use to manage secrets from env files?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 83 posts

Re: Ask HN: What tools should I use to manage secrets from env files?

#51

Post by starwatch »

barbazoo wrote: post #32
starwatch wrote: post #12

There are varying degrees to this but I'll focus on the early stage, low effort approaches I've found work. For an easy, slightly hacky version I've used git-crypt ( https://github.com/AGWA/git-crypt ) with tiny teams. You'll need to share the decryption key (e.g. via 1password shared vaults). As your need for security grows (but you're still not working with a giant team) you're better off using non-committed .env f…

So what you see when you look at the repo in Github et al is the encrypted file and locally you see the file unencrypted? That's neat, a bit like ansible-vault but less of a hassle for the user.

yes, exactly right. it's an encrypted binary on github, but locally (provided you've decrypted it) it'll be unencrypted. If you edit the file locally, it automatically encrypts. It's a neat bit of tech.

Re: Ask HN: What tools should I use to manage secrets from env files?

#52

Post by starwatch »

mtarnovan wrote: post #31
starwatch wrote: post #12

There are varying degrees to this but I'll focus on the early stage, low effort approaches I've found work. For an easy, slightly hacky version I've used git-crypt ( https://github.com/AGWA/git-crypt ) with tiny teams. You'll need to share the decryption key (e.g. via 1password shared vaults). As your need for security grows (but you're still not working with a giant team) you're better off using non-committed .env f…

> You'll need to share the decryption key (e.g. via 1password shared vaults). Not really. It also supports keeping the symmetric decryption key encrypted with the GPG key of each added user (and handles this automatically). This is the default behavior. What you're saying also works (quoting from readme, emphasis mine: " Alternatively , you can export a symmetric secret key, which you must securely convey to collabor…

True on all counts. I never got the GPG approach working - though admittedly I didn't put too much effort into figuring it out.

Re: Ask HN: What tools should I use to manage secrets from env files?

#53

Post by gervwyk »

rguldener wrote: post #19

I heard good things about Infisical (open source, end to end encryption of secrets): https://infisical.com/

We use infisical to manage 100s of secrets in our various environments. Honestly don’t know how we coped before it.. Makes it very easy especially for a team where devs jump between projects. It has a few areas which can get frustrating and they had a few bugs some time ago.. but it has been a excellent improvement in our workflow for day to day dev and deployment.

Re: Ask HN: What tools should I use to manage secrets from env files?

#54

Post by scottmotte »

saturn-five wrote: post #49
PaulHoule wrote: post #13

What about https://dotenvx.com/ ?

This is by far the simplest solution. It’s easier to understand and setup than the other solutions mentioned. It simply encrypts the value portion of the variable so its safe to commit the entire env file. The only draw back is developers could still potentially commit private keys the repo or commit the decrypted env file. If you’re working with env variables that don’t require updates often it’s a decent solution.

> developers could still potentially commit private keys the repo or commit the decrypted env file

to prevent this, use:

$ dotenvx ext precommit --install

Re: Ask HN: What tools should I use to manage secrets from env files?

#55

Post by mdaniel »

FooBarWidget wrote: post #39
ali_piccioni wrote: post #34

In priority, 1. Stop using API keys. Configure SSO integration for developers and OIDC for automation. For example, this is very easy to setup with AWS. 2. If the above is not possible, then store credentials encrypted at rest. Decrypt them only at runtime. For example, SOPS to store encrypted credentials into the repo, then AWS KMS holds the decryption key. The SOPS Readme is very helpful.

Let's say you're not on a major public cloud. Let's say you're on Hetzner How do you setup something like OIDC for workloads (workload identity)?

I was curious about this and went sniffing around and it seems that their instance metadata[1] doesn't include anything that demonstrably associates the instance with Hetzner nor your specific account, making chain of custody ... tricky.

The best work-around I could come up with (not having a Hetzner account to actually kick the tires upon) is that you could inject a private key that you control into the instances via cloud-init (or volume attachment) and then sign any subsequent JWT using it. For sure it would not meet all threat models, but wouldn't be nothing either. I was hoping there was some chain of custody through Vault[2] but until Hetzner implements ANY IAM primitives, I'm guessing it's going to be a non-starter since the instances themselves do not have any identity

1: https://docs.hetzner.cloud/#server-metadata

2: https://github.com/hashicorp/vault/blob/v1.14.7/website/cont...

Re: Ask HN: What tools should I use to manage secrets from env files?

#56

Post by karmajunkie »

drcongo wrote: post #9
solardev wrote: post #2

Does your team already use a password manager? (If not, they probably should) Some of them have secrets management built-in too, like: - https://1password.com/developers/secrets-management - https://bitwarden.com/products/secrets-manager/

I tried to get my head around the 1Password implementation of this, but as far as I could work out, every single secret is stored as an individual item in 1Password and the 1Password app makes no accommodations for the differences between a server secret and a login. We have maybe 100 projects, with multiple environments for each, and multiple secrets in each environment - managing this in 1Password looks like it wou…

just guessing but since access keys are paired with secrets that’s why you see a username and password there.

1p lets you create arbitrary fields in an entry, so you could create one with a VARNAME field or something, or just use a naming convention on the entry. for project isolation you could create separate vaults or use tags to distinguish.

Re: Ask HN: What tools should I use to manage secrets from env files?

#57

Post by CMCDragonkai »

mdaniel wrote: post #50
CMCDragonkai wrote: post #45

Usually `.env` files are sourced into your development shell and also ignored by `.gitignore`. The problem with `.env` files is that you're leaving credentials unencrypted on disk and it's easy to leak these files during screen sharing and with multiple projects there will eventually there will be so many secrets spread/sprawled everywhere that you lose track of what credentials are being used and what are expired. Y…

It may seem this is snark, but I promise I don't mean it that way: why do you not drink your own champagne? https://github.com/MatrixAI/Polykey/blob/v1.13.0/.github/wor... I see references to gitlab CI yamls in the source tree, implying you are multi-CI which seems like an extra awesome way to showcase the one source of truth for credentials. Bonus confetti if Ploykey were able to auth as the CI job via https://docs.…

Yes, you are right to point this out. We are dogfooding Polykey in our own company's operations, specifically integrating it into all of our team member's NixOS development platforms with the control plane beta PKE (Polykey Enterprise).

Using Polykey in the CI/CD situation as you point out in your links is actually one of the major complex usecases we designed Polykey for, however it's actually quite a complex problem domain. We expect to do a sort of "painkiller" phase 1 first where PK is used as the network for sharing secrets, and then a subsequent "vitamin" phase 2 where secrets are no longer shared at all, because authority is delegated through trust federation.

Right now PK is a decentralized secret sharing system (every agent is a P2P node), so there's no well-known trust anchor to form a trust federation via OIDC. However once we have PKE ready, then we plan to enable OIDC customer portals within PKE following ideas from https://openid.net/specs/openid-federation-1_0.html (e.g. yourcompany.enterprise.polykey.com). This requires a more sophisticated policy-logic system integrated into each Polykey node's sigchain, atm we have work in progress for public/private network segregation.

In our internal documentation, I have a diagram of how PK would integrate into a CI architecture, just haven’t shared it publicly yet. I’ll try to get it out soon. Let me know if you’re interested in more details!

Re: Ask HN: What tools should I use to manage secrets from env files?

#60

Post by emmaqueen »

TheBigDuck234 wrote: post #59

We ended up going with Doppler for secrets management. Was super easy to set up. I looked at a few others, but we would either need to self host or they were going to be clunky to set up. No more .env files to leak!

[flagged]
Post reply on HN